Redirect Issue when trying to integrate AWS with Entra using OpenID Connect

Shoeb Ahmad 0

I have configured the settings in both Entra and AWS. The issue I am currently facing is that the application takes to me a generic AWS homepage instead of the landing page in AWS Management Console (https://console.aws.amazon.com/console/home).

Below are some details:

Timestamp of the Issue: While no formal error message was shown at a specified date and time after logging in using the application, I tried to run it at 10:15am EST today, December 19, 2024.

Steps to Reproduce the Issue: Logged into the application at myapplications.microsoft.com. Selected the application configured to integrate with AWS using OpenID Connect (OIDC). I am first taken to an Entra login page at the link https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize?client_id={client-id}&response_type=code&redirect_uri=https%3A%2F%2Fsignin.aws.amazon.com%2Foidc&scope=openid%20profile%20email&state=random-string&nonce=random-nonce&prompt=login. Instead of being directed to the AWS Management Console, I was redirected to the generic AWS homepage at this URL https://aws.amazon.com/?code={authorization-code}&state=random-string&session_state={session-state-number}.

Environment: Identity Provider: Microsoft Entra ID (Azure AD)

Federation Type: OpenID Connect (OIDC)

AWS Service Used: AssumeRoleWithWebIdentity Method: Web Browser Login (I accessed the application via a browser and clicked on the AWS-related app in the Azure portal at myapplications.microsoft.com. The redirection issue occurred during this login flow)

Akhilesh Vallamkonda 10,860 Reputation points Microsoft Vendor

2024-12-23T08:16:30.1866667+00:00

Hi @Shoeb Ahmad
Thank you for reaching us!
Based on the information you provided, it might be the issue with the redirection URL.
Please verify that the redirect_uri parameter in your OpenID Connect (OIDC) request is correctly set to the expected endpoint. It should match the endpoint configured in AWS for handling the login flow. try to update redirection URL, try logging in to the application again and see if the issue is resolved.
Shoeb Ahmad 0 Reputation points

2024-12-25T05:47:05.45+00:00
Hi Akhilesh,

I have verified and updated redirect_uri parameter at least four times. Can you suggest what it should look like? When you say it should match the endpoint configured in AWS for handling the login flow, what are you referring to exactly? It doesn't look like the token exchange is occurring, otherwise, I should not see the url I am taken to after Entra login. The url https://aws.amazon.com/?code={authorization-code}&state=random-string&session_state={session-state-number} opens to a generic AWS homepage, here is what the login flow should be:

I log into Azure AD via the application in myapplications.microsoft.com

Azure AD redirects me to https://signin.aws.amazon.com/oidc with an authorization code.

AWS exchanges the authorization code for an ID token, validates it, and uses the token’s claims to map the user to an IAM role.

I am directed to the AWS Management Console with the permissions granted by the IAM role.

Share via

Redirect Issue when trying to integrate AWS with Entra using OpenID Connect

Your answer